VB 4.2.3 infected by cryptomining malware

[Dreslough]

I was able to find the script in our site tempalte's ad footer. Took a while. For future reference is there a tool that will search all of vBulletin for "coinhive" instead of having to hand-edit every single template item?

Also, not sure how to prevent this in the future since we have no plug-ins that could have opened the door (and it seems quite unlikely someone guessed my old password).